What is CVE-2019-25235?

CVE-2019-25235 is a critical-severity vulnerability in Smartwares Home Easy, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 9.8/10. Published 2025-12-24.

How severe is CVE-2019-25235?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Auth bypass in Smartwares Home Easy

CVE-2019-25235

Smartwares HOME easy 1.0.9 contains an authentication bypass vulnerability that allows unauthenticated attackers to access administrative web pages by disabling JavaScript. Attackers can navigate to multiple administrative endpoints and to bypass client-side validation and access sensitive system information.

Vulnerability class: IDOR (Insecure Direct Object Reference)

EPSS: 0.004 (36.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Smartwares Home Easy — versions 1.0.9

Weakness classification (CWE)

CWE-639 — Authorization Bypass Through User-Controlled Key

References

disclosure@vulncheck.com (exploit)
disclosure@vulncheck.com (product)
disclosure@vulncheck.com (third-party-advisory)

Frequently asked questions

What is CVE-2019-25235?: CVE-2019-25235 is a critical-severity vulnerability in Smartwares Home Easy, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 9.8/10. Published 2025-12-24.
How severe is CVE-2019-25235?: Critical severity. CVSS v3 base score is 9.8 out of 10.